Sunday, July 14, 2024

Ryuk Ransomware Operators Employ Powershell Commands to Deploy Ransomware

Recently, cybersecurity experts have claimed that the operators of Ryuk Ransomware are targeting severe infrastructures to extort high ransom from their victims.

In 2018, the Ryuk ransomware was spotted for the first time, and the security researchers claim that the Ryuk procured and developed by its operators from the Hermes ransomware’s source code. 

As last year one of the largest health care organizations that has more than 90,000 employees, 400 hospitals, behavioral health centers, outpatient clinics in the U.S. and U.K. have been attacked by the operators of Ryuk Ransomware.

By force, the organization had to covey all their patients to other hospitals and health centers, as the attackers managed to gain access to their internal IT network and shut down all the internal computer systems of this organization in the US.

However, in the victim list of Ryuk ransomware, there are not only health organizations, even there are other infrastructures as well, and here they are:-

  • Several oil and gas companies.
  • A U.S. agency.
  • A large engineering and construction services firm.
  • City and county government.
  • A financial software provider.
  • A food and drink manufacturer.
  • A newspaper.

But, later, the FBI publicly issued a warning about the Ryuk ransomware operators in June 2020, in which they claimed that the operators of Ryuk ransomware were also targeting educational institutes like K-12 institutes.

New tactics

As initial droppers, the operators of Ryuk ransomware have used the following malware:-

But, they have now adopted new methods and tactics, “PowerShell commands” by encoding this, they do the following things:-

  • Download the first payload.
  • Disable security tools.
  • Stop data backups.
  • Scan the network.

Apart from these things, to deploy the ransomware on the infected system, they also exploit the Windows Management Instrumentation (WMIC) and BitsAdmin. 

The operators of Ryuk ransomware designed this new strategy form to empower the ransomware to remain hidden for a longer time on the infected networks without any detection.

Hits the Government Systems

By using the new strategy form and tools, the operators of Ryuk ransomware have also targeted the government systems, and during their attack, they managed to encrypt near about 2,000 internal systems and critical services.

While the experts explain that to execute this attack the operators of Ryuk have first gain access to an account of a domain administrator whose passwords were saved in a group policy.

Here, to scan the network and disable the security tools, the attackers used PowerShell; after that to copy the Ryuk to additional hosts with privileged account credentials they exploited the Windows Management Instrumentation (WMIC), PowerShell, and BitsAdmin.


Moreover, the U.S. federal government have suggested the companies few recommendations to combat these threats, and here they are mentioned below:-

  • Perform regular backups.
  • Risk analysis to identify all the potential issues.
  • Proper staff training.
  • Keep the systems updated with the latest updates and security patches.
  • Application whitelisting to keep track of all the approved applications.
  • Incident response to identifying and eliminate cyberattacks.
  • Business Continuity.
  • Penetration Testing.

Cybersecurity analysts have ensured that by following the above-mentioned recommendations the companies and organizations will be able to protect their users from cyber attacks like this.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.


Latest articles

mSpy Data Breach: Millions of Customers’ Data Exposed

mSpy, a widely used phone spyware application, has suffered a significant data breach, exposing...

Advance Auto Parts Cyber Attack: Over 2 Million Users Data Exposed

RALEIGH, NC—Advance Stores Company, Incorporated, a prominent commercial entity in the automotive industry, has...

Hackers Using ClickFix Social Engineering Tactics to Deploy Malware

Cybersecurity researchers at McAfee Labs have uncovered a sophisticated new method of malware delivery,...

Coyote Banking Trojan Attacking Windows Users To Steal Login Details

Hackers use Banking Trojans to steal sensitive financial information. These Trojans can also intercept...

Hackers Created 700+ Fake Domains to Sell Olympic Games Tickets

As the world eagerly anticipates the Olympic Games Paris 2024, a cybersecurity threat has...

Japanese Space Agency Spotted zero-day via Microsoft 365 Services

The Japan Aerospace Exploration Agency (JAXA) has revealed details of a cybersecurity incident that...

Top 10 Active Directory Management Tools – 2024

Active Directory Management Tools are essential for IT administrators to manage and secure Active...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Free Webinar

Low Rate DDoS Attack

9 of 10 sites on the AppTrana network have faced a DDoS attack in the last 30 days.
Some DDoS attacks could readily be blocked by rate-limiting, IP reputation checks and other basic mitigation methods.
More than 50% of the DDoS attacks are employing botnets to send slow DDoS attacks where millions of IPs are being employed to send one or two requests per minute..
Key takeaways include:

  • The mechanics of a low-DDoS attack
  • Fundamentals of behavioural AI and rate-limiting
  • Surgical mitigation actions to minimize false positives
  • Role of managed services in DDoS monitoring

Related Articles